Re: cryptsetup - No key available with passphrase

On Thu, Mar 2, 2023 at 5:41 PM Milan Broz <[email protected]> wrote:
>
> On 3/2/23 17:23, Lars Francke wrote:
> > Milan,
> >
> > thank you for the quick reply. I did try that but unfortunately:
> >
> > root@archiso ~ # echo 'a' | cryptsetup luksFormat /dev/nvme0n1p5
> > WARNING: Device /dev/nvme0n1p5 already contains a 'crypto_LUKS'
> > superblock signature.
> > root@archiso ~ # echo 'a' | cryptsetup luksOpen /dev/nvme0n1p5 cryptroot
> > No key available with this passphrase.
> >
> >
> > I also just used the `echo` method to make it easier to replicate.
> > The same happens when I just press "a" on my keyboard and hit enter.
> >
> > What makes it even weirder is that it did work _once_:
>
> Did you deactivate the device once it succeeded?

I have to admit that I'm also not entirely sure what you mean by
"deactivate" in this case.
But probably not then :)

I did a new test:
1. cat /dev/zero | wcs > /dev/nvme0n1p5 (this actually gave a kernel
error after writing 500GB / unable to handle page fault for address
..... but I'm going to assume that this is unrelated for now as I
assume cryptsetup doesn't care about something 500GB down the line
when opening)
2. wipefs /dev/nvme0n1p5 -> Empty
3. cryptsetup luksFormat /dev/nvme0n1p5 -> Manually hit the "a" key
followed by enter, verify a second time. All good
4. # wipefs /dev/nvme0n1p5
DEVICE    OFFSET TYPE        UUID                                 LABEL
nvme0n1p5 0x0    crypto_LUKS 695c4fc2-9d95-4460-b9cd-9933803d176b
nvme0n1p5 0x4000 crypto_LUKS 695c4fc2-9d95-4460-b9cd-9933803d176b

From all I read it is normal to have two signatures (secondary)

5. cryptsetup luksOpen, manually press "a" and the same error "No key
available with this passphrase"

I honestly don't understand what the problem could be. All of this did
work last week and it did work _once_ earlier today for some reason.
I checked smartctl to make sure that the hard drive is not reporting
any errors and it doesn't

I also tried this with an Ubuntu USB stick now which has cryptsetup 2.5.0

Can you think of _anything_ else to try? I'm a bit desperate :)

Thank you,
Lars


> Anyway, it should work as I described. Maybe you should wipe the
> signature before format with "wipefs -a /dev/nvme0n1p5" (but it should
> overwrite it anyway or print error).
>
> You can also use --test-passphrase to luksOpen to avoid activation.
>
> Milan
>
> >
> > # echo 'a' | cryptsetup luksFormat /dev/nvme0n1p5
> > WARNING: Device /dev/nvme0n1p5 already contains a 'crypto_LUKS'
> > superblock signature.
> > # echo 'a' | cryptsetup luksOpen /dev/nvme0n1p5 cryptroot
> >
> > I'm at a loss but will now read the section in the man page that you
> > referred to.
>
>
>
> >
> > Thanks again,
> > Lars
> > On Thu, Mar 2, 2023 at 4:01 PM Milan Broz <[email protected]> wrote:
> >>
> >> On 3/2/23 15:03, Lars Francke wrote:
> >>> Hello,
> >>>
> >>> I am trying to setup LUKS (and I've done it like this in the past,
> >>> like...two weeks ago and it just stopped working) and am running into
> >>> the following issue:
> >>>
> >>> root@archiso ~ # echo 'a' | cryptsetup  luksFormat --batch-mode /dev/nvme0n1p5 -
> >>> root@archiso ~ # echo 'a' | cryptsetup luksOpen /dev/nvme0n1p5 cryptroot -
> >>> No key available with this passphrase.
> >>
> >> This is just a little bit confusing handling of end-of-line if used with "-"
> >> (see section "Passphrase processing for LUKS" in man cryptsetup).
> >>
> >> The first command will create passphrase "a\n" (including \n !) while the second
> >> command will process only "a" (you can to use --key-file=- there for luksOpen,
> >> it has different syntax.)
> >>
> >> But just do not use "-" here, cryptsetup will do what needed automatically.
> >> Also batch mode is implicit if it detects pipe input, so just use:
> >>
> >> # echo 'a' | cryptsetup luksFormat /dev/nvme0n1p5
> >> # echo 'a' | cryptsetup luksOpen /dev/nvme0n1p5 cryptroot
> >>
> >> and it should work as expected (password will be "a").
> >>
> >> Milan